1165018 matches found
PT-2026-65727
The Database for CF7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Array Form Field Values in all versions up to, and including, 1.2.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...
CVE-2025-65337
Sourcecodester Fantastic Blog CMS 1.0 is vulnerable to Cross Site Scripting XSS in pageEditMember.php via the address field...
PT-2026-65905
Name of the Vulnerable Software and Affected Versions Sourcecodester Fantastic Blog CMS version 1.0 Description Cross Site Scripting XSS occurs in the 'pageEditMember.php' endpoint through the address field. XSS is a flaw that allows an attacker to inject malicious scripts into web pages viewed b...
Gitlab -- vulnerabilities
Gitlab reports: Sensitive Information Exposure issue in Workhorse impacts GitLab CE/EE Mass Assignment issue in Pipeline Schedule API impacts GitLab CE/EE Denial of Service issue in Merge Request Discussions impacts GitLab CE/EE Race Condition issue in merge request approval rules impacts GitLab ...
PT-2026-65781
The WPC Badge Management for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'text' attribute of the wpcbm best seller shortcode in all versions up to, and including, 3.1.6 due to insufficient input sanitization and output escaping on user supplied attributes...
PT-2026-65782
The Booking System Trafft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the bookingWebsiteUrl setting in all versions up to, and including, 1.0.17 due to a missing capability check on the set options AJAX action when the plugin is operating in agency mode. The...
PT-2026-65808
Joomla Extension - balbooa.com - Stored cross-site scripting via a comment avatar in Gridbox 2.20.2...
CVE-2025-65337
Sourcecodester Fantastic Blog CMS 1.0 is vulnerable to Cross Site Scripting (XSS) . The flaw exists in the pageEditMember.php component, specifically triggered through the address field. Exploitation details or specific proof-of-concept links are not provided in the documentation. Impact is chara...
cve-2026-59328 - MEDIUM - CVE-2026-59328: Cross-Site Scripting in Eclipse Spring Boot Starter Wizard Dependency Tooltips
Spring Tools for Eclipse renders Spring Boot starter wizard dependency tooltips in a native embedded browser SWT Browser with JavaScript enabled. Using untrusted and compromised Initializr endpoints for the Spring Boot starter wizard can result in arbitrary script execution inside the embedded...
CVE-2025-65337: Improper Neutralization of Input During Web Page Generation
Sourcecodester Fantastic Blog CMS 1.0 is vulnerable to Cross Site Scripting XSS in pageEditMember.php via the address field...
CVE-2026-3093: Improper Neutralization of Input During Web Page Generation
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an attacker to execute arbitrary JavaScript in another user's browser via a crafted URL, due to improper...
PT-2026-65772
The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Name Field Nested password Member in all versions up to, and including, 6.2.7 due to insufficient input sanitization and output escaping...
RockyLinux 9 : php (RLSA-2026:33449)
The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:33449 advisory. php: php-soap: php-src: PHP SOAP extension: Remote Code Execution via use-after-free vulnerability CVE-2026-6722 PHP: PHP: Denial of Service via imprope...
PT-2026-65681
The WowStore – Store Builder & Product Blocks for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'currentPostId' Block Attribute in all versions up to, and including, 4.4.24 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2026-17162: Improper Neutralization of Input During Web Page Generation
The WowStore – Store Builder & Product Blocks for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'currentPostId' Block Attribute in all versions up to, and including, 4.4.24 due to insufficient input sanitization and output escaping. This makes it possible for...
PT-2026-65680
The WowStore – Store Builder & Product Blocks for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'filterMobileText' Block Attribute in all versions up to, and including, 4.4.24 due to insufficient input sanitization and output escaping. This makes it possible fo...
PT-2026-65696
The WOLF WordPress plugin before 1.1.0 does not perform a nonce or capability check on one of its AJAX actions, allowing an unauthenticated attacker to trick a logged-in administrator into writing arbitrary content, including a malicious script, into a post via a cross-site request, resulting in...
PT-2026-65716
Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Link Library allows Cross-Site Scripting XSS. This issue affects Link Library: before 7.9.4...
PT-2026-65793
Name of the Vulnerable Software and Affected Versions RO CSVI versions prior to 9.11.0 Description Cross-Site Scripting XSS vectors exist within the AJAX endpoint handlers of the RO CSVI Joomla extension. XSS is a security flaw that allows an attacker to inject malicious scripts into web pages...
